How to configure anyconnect start before logon? How to configure SBL?

How to configure anyconnect start before logon? How to configure SBL?

  June 21, 2018    Raj

---

Cisco Any-connect provides a feature for Windows users to start any-connect even before they login to computers. This is SBL : start before logon.

Prerequisites: 

1. ASDM access to the ASA
2. A client profile must be created and must have server list defined. Client profile can be created at following location in ASDM.
Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Client Profile

3. You must have  a valid certificate on your ASA. If you are using a self signed certificate make sure to add that under trusted root store of machine store.

4. Once you the client profile, make sure to check mark (enable) SBL:



5. You can have this feature "User controllable" or not. Once user controllable is checked, users will be able to enable and disable the feature using  any-connect settings.

6. Now having only any-connect installed on machine does not give capabilities to start it before logon. We need to have a module installed into machine which will help initiate Any-connect before logon. This can be done using SBL module in group policy. Once a user connects to VPN and gets this group policy , SBL module download in the machine.

7. Call SBL module/vpngina module into the group policy.
8. Make sure any-connect version installed on client PC is same as the package file on ASA. If they are not same then make sure "Auto update" feature is enabled in client profile.



Verification:
==========

1. Connect with any-connect, it will download SBL module and new XML profile. Once it is done, you should be able to see  this installed in control panel.
2. You will need to restart your computer.
3. After it boots up, on logon screen, press crtl+alt+del
4. You will see a computer icon in right bottom corner. Click on it and that launches any-connect.

Read More

How to control SSH access via LDAP?

How to control SSH access via LDAP?

  June 14, 2018    Raj

---

I have an ASA and LDAP server. I am doing all my authentications with this LDAP server, even SSH.

The problem I ran into is: all my authenticated users are able to SSH my ASA. While I want only few users to have admin access to ASA, probably a group of users.

I have created an admin group in LDAP and only those users should be able to login to ASA and no one else.



SOLUTION:


This is how I fixed it:

I already had authentication server group configured on ASA that is being used for authentication.

I created an LDAP attribute map to match the "memberOf" attribute sent from server and then assign a service-type 6.

Example:

ldap attribute-map mymap

map-name  memberOf IETF-Radius-Service-Type

map-value memberOf CN=Admin,OU=acb,OU=Loc,DC=test,DC=com 6

Apply the ldap attribute map in aaa server group that is being used for authentication.

With this, if a user is a member of Admin group then only he/she will be allowed to SSH to the device otherwise not. 

If you are still unable to make it work then please post your comment and I should be able to help you out.

Read More

I cannot see anyconnect adapter in wireshark.

I cannot see anyconnect adapter in wireshark.

  June 12, 2018    Raj

---

And yes, I ran into this problem.

Things were doing great and suddenly I stopped seeing my any-connect adapter in wire-shark. It used to be there when I use wire-shark as run as admin. I don't see it anymore.

Here is what you can do:

1. kill wire-shark process
2. open cmd as administrator
3. sc stop npf



4. sc start npf

 

You should be good now.
 

Read More

SSH issue: SSH-3-NO_MATCH: No matching cipher found

SSH issue: SSH-3-NO_MATCH: No matching cipher found

  June 01, 2018    Raj

---

Router1------ Router2---- PC2

I have two routers connected and configured for SSH. When I use PC2 to SSH to Router2, it works fine.

I am trying to SSH to Router2 from Router1 and in "debug ip ssh" I see following error

SSH-3-NO_MATCH: No matching cipher found

Here in this scenario Router1 is SSH client and Router2 is SSH server.

Solution:
=======
On Router1 I configured the following:

Router1#conf t
ip ssh client algorithm encryption aes128-cbc aes192-cbc aes192-ctr aes128-ctr 3des-cbc aes256-cbc aes256-ctr

On Router2 I configured the following:

Router2#conf t
ip ssh server algorithm encryption aes128-cbc aes192-cbc aes192-ctr aes128-ctr 3des-cbc aes256-cbc aes256-ctr

Read More

ASA doesn't display Primary/secondary status.

ASA doesn't display Primary/secondary status.

  June 01, 2018    Raj

---

Hello again,

I had a pair of ASAs and wanted to put them in failover. I configured that and everything was working fine.
Only thing I did not like was how my ASA was displaying its name. On both ASAs I see the name as ciscoasa#

I wanted it to be something that can tell me on which ASA I am. Am I on Primary or Secondary ASA?
Am I on Active or standby ASA?

"sh failover" will show that.

Then I figured out that we can even have the "priority" and "state" displayed right there in hostname.

Use command " prompt"

ASA1(config)# prompt hostname ?

configure mode commands/options:
  cluster-unit     Display the cluster unit name in the session prompt
  context          Display the context in the session prompt (multimode only)
  domain           Display the domain in the session prompt
  management-mode  Display management mode
  priority         Display the priority in the session prompt (If your ASA is Primary/Secondary)
  state            Display the traffic passing state in the session prompt (Active or Standby)
  <cr>

With command "prompt hostname" it will only display ASA hostname. Now if you want to display "priority" of ASA use "prompt hostname priority".

Let's also have "state" displayed as well:

ASA1(config)# prompt hostname  priority state

Read More